← Docs

Reviewing remediation PRs

Remediation PRs are ordinary pull requests — review and merge them the same way you would any automated dependency-update PR. Each PR body explains what changed and links back to this page's marker syntax for reference.

A pull request diff showing an actions/checkout line re-pinned from a stale commit SHA to a freshly-resolved one, while the adjacent no-op-marked actions/setup-node line stays unchanged.

The example above is a real remediation PR: actions/checkout's pin had gone stale and was re-pinned, while the actions/setup-node line — marked ActionLock: no-op — was correctly left alone in the same pass.